feat: check cap privileges instead of Geteuid during starting the agent

[spencercjh]

RESOLVE #224

Reference：https://sites.google.com/site/fullycapable/getting-started-with-go/other-linux-capability-go-packages

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
kyanos	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 3, 2025 11:51am

[spencercjh]

This project uses containerd/v1, so I'm not using v2 here either.

[hengyoush]

I think we can add a test script to test it: create a container and copy kyanos and a script in to the container, then execute the copied script which will start kyanos(will failed) and check the log. This is a failed case.

If do better we can create a containter with CAP_BPF then start kyanos in it, expect successfully.

[spencercjh]

I think we can add a test script to test it: create a container and copy kyanos and a script in to the container, then execute the copied script which will start kyanos(will failed) and check the log.

If do better we can create a containter with CAP_BPF then start kyanos in it, expect successfully.

Indeed, we need a dockerfile to build a container environment that can run kyanos.

[hengyoush]

Just run an alpine container is sufficient, use --cap-add and --cap-drop to control capabilities. Just look at testdata/run_k8s_test.sh, this script use kind but we can simple use alpine image.

[Issues-translate-bot]

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

Just run a alpine container is sufficient.

[hengyoush]

Try add this cap: CAP_SYS_RESOURCE to container .

Until kernel version v5.11 this mechanism was used to track and limit the memory usage of BPF maps which count towards the locked memory limit, so you commonly would have to increase or disable this rlimit which requires an additional capability CAP_SYS_RESOURCE.
Refer: https://docs.ebpf.io/linux/concepts/resource-limit/

[hengyoush]

Or we can just run test container in privileged mode, i think it is enough.

[hengyoush]

LGTM.